CVE-2017-11387

{"id": "CVE-2017-11387", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2017-08-02T21:29:00.337", "references": [{"url": "http://www.securityfocus.com/bid/100078", "source": "security@trendmicro.com"}, {"url": "http://www.securitytracker.com/id/1039049", "source": "security@trendmicro.com"}, {"url": "http://www.zerodayinitiative.com/advisories/ZDI-17-497", "tags": ["Third Party Advisory", "VDB Entry"], "source": "security@trendmicro.com"}, {"url": "https://success.trendmicro.com/solution/1117722", "tags": ["Patch", "Vendor Advisory"], "source": "security@trendmicro.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-200"}]}], "descriptions": [{"lang": "en", "value": "Authentication Bypass in Trend Micro Control Manager 6.0 causes Information Disclosure when authentication validation is not done for functionality that can change debug logging level. Formerly ZDI-CAN-4512."}, {"lang": "es", "value": "Una vulnerabilidad de omisi\u00f3n de autenticaci\u00f3n en Trend Micro Control Manager 6.0 podr\u00eda permitir que se divulgue informaci\u00f3n cuando la validaci\u00f3n de la autenticaci\u00f3n no se realiza para la funcionalidad que puede cambiar el nivel de registro de depuraci\u00f3n. Anteriormente esta vulnerabilidad ten\u00eda el c\u00f3digo ZDI-CAN-4512."}], "lastModified": "2017-08-06T01:29:00.733", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:trendmicro:control_manager:6.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2F7E3779-69E4-46AB-94E3-4A81E35A5194"}], "operator": "OR"}]}], "sourceIdentifier": "security@trendmicro.com"}